@akanjs/cli 3.0.0-alpha.15 → 3.0.0-alpha.16

package/.build-stamp

@@ -1 +1 @@
-714e226e4dda771d192ec7f6f9b947d03b5556e07bb7303ac02e0287c2e03d53
+de2c79f1b77d3ad7b42a84df41633392b3eba192d3d15335be7a976440157d1f

package/guidelines/conventions/conventions.instruction.md

@@ -344,10 +344,6 @@ than returning it (`no-return-in-store-action.grit`); a bare `return;` guard sta
 `.of() → .model() → .insight() → .query() → .sort() → .enum() → .slice() → .endpoint() → .error() → .translate()`.
 Name every argument in `.arg()`, including framework-supplied `skip` / `limit` / `sort`. Use `modelDictionary`,
 `scalarDictionary`, or `serviceDictionary` to match the module kind.
-**`.store()` sits between `.endpoint()` and `.error()` and is the one optional stage** — omit it entirely rather
-than writing it empty. It names custom store actions (labels and `.desc()` only, no `.arg()`), and it is only
-needed where inheriting would be wrong: an action named after the endpoint it calls already reads as that
-endpoint's `.desc()`, which is most of them. `akan.agent.missing-store-description` names the rest.
 
 **`<module>.abstract.md`** — a title line, one declarative sentence naming what the module owns, a `## Rules` list of
 two to five invariants the code cannot show, and an optional workflow arrow chain
@@ -374,8 +370,10 @@ workflow changes.
 
 - **Every `slice()` takes an explicit `{ guards: {…} }` second argument, and `root:` is always `Admin`.**
 - **Every custom `mutation` / `query` / `message` names its own `guards: [...]` array.** Never rely on the slice default. `Public` belongs on a slice `get:`, never on a mutation.
+- **The guards are also the MCP exposure decision** — see MCP Exposure. An endpoint that names none is not published to agents at all, and a mutation whose only guard is `Public` is refused, so a missing `guards` array now costs visibility as well as authorization.
 - Resource guards are `Can<Verb><Model>` classes in `srvkit/guards.ts` that `implements Guard` with an `async canPass(context)`. They **fail closed**: no resource named ⇒ `false`; a load that throws ⇒ `logger.warn` then `false`. Admin bypass goes first.
 - Keep `static name = "User";` on guard classes. `fetch` serializes guard names and the API explorer filters on them; it looks like dead code, and deleting it breaks the UI. Comment it so the next reader knows.
+- **Every guard class also declares `static scope: GuardScope`, and it is required with no default.** `"account"` means the verdict reads the caller and nothing about the call, so it can be evaluated with no arguments — which is what lets an MCP listing hide what this caller certainly cannot use. `"resource"` means it needs the call's arguments (`context.getArg()`) and fails closed without them, so it is never evaluated for a listing: the entry stays visible and is stopped at call time. Getting it wrong is not a type error, so the marker is mandatory rather than defaulted — `SignedIn` / `Admin` / role checks are `"account"`, and every `Can<Verb><Model>` is `"resource"`.
 - The acting user arrives via `.with(Self)` / `.with(CurrentUserId)` / `.with(Me)`. Never trust a client-supplied id.
 - Guards ship with the library that owns the model and are imported by its own signals through the package path, so a mounting app inherits authorization and cannot forget it.
 - Services re-check ownership even when a guard already gated the call — two independent gates.
@@ -477,8 +475,15 @@ Conventions that hold for both shapes:
 
 ### MCP Exposure
 
-Any signal can be served to AI agents as an MCP server on `POST /mcp`, and **nothing is exposed until it says so**.
-Turn it on in the app's `main.ts` — `new AkanApp("./server", { mcp: { … } })` — which takes `enabled`, `readOnly`,
+Every signal is served to AI agents as an MCP server on `POST /mcp`. **`/mcp` is mounted by default and exposure
+follows an endpoint's guards — there is no per-endpoint opt-in, and nothing to write in a signal file.** An endpoint
+that declares a real guard is published; one that declares none is refused, and so is a mutation whose only guard is
+`Public`. `AKAN_MCP=false` takes the whole surface off. The reasoning is that the guards are already the
+authorization decision and `filterForAccount` re-reads them per caller on every listing, so a second per-endpoint
+switch says nothing the guards do not — while guaranteeing that every endpoint added later is invisible to agents
+until somebody remembers it.
+
+Settings live in the app's `main.ts` — `new AkanApp("./server", { mcp: { … } })` — which takes `enabled`, `readOnly`,
 `path`, `version`, `instructions`, `allowedOrigins`, `pageSize`, `language`, and `auth`. That is the only
 app-authored place for it: `server.ts` is generated and takes no options, and the gateway configures a child
 through its environment — so each field also has an env spelling (`AKAN_MCP`, `AKAN_MCP_READONLY`,
@@ -490,26 +495,26 @@ has, and a value written in code wins over the env of the same name — an expli
 concatenation.
 
 ```typescript
-// <model>.signal.ts — a tool, a resource-backed slice, and a slash-command prompt
+// <model>.signal.ts — every one of these is an MCP tool or prompt, with no `mcp:` option anywhere
 export class TaskSlice extends slice(
   srv.task,
-  // generated CRUD per verb; `list` is the model's own unfiltered list, which `slice()` generates itself
-  { guards: { root: Admin, get: SignedIn, cru: SignedIn }, mcp: { get: true, list: true } },
+  { guards: { root: Admin, get: SignedIn, cru: SignedIn } },
   (init) => ({
-    // its own guards: the map above reaches base CRUD and the root slice, never a named slice
-    inTodo: init({ guards: [SignedIn], mcp: { expose: true } }).exec(function () {
+    // its own guards: the map above reaches base CRUD and the root slice, never a named slice — so a named slice
+    // that names none is refused rather than published, which is the one shape to watch for.
+    inTodo: init({ guards: [SignedIn] }).exec(function () {
       return this.taskService.queryByStatuses(["todo"]);
     }),
   }),
 ) {}
 
 export class TaskEndpoint extends endpoint(srv.task, ({ mutation, prompt }) => ({
-  startTask: mutation(cnst.Task, { guards: [SignedIn], mcp: { expose: true } })
+  startTask: mutation(cnst.Task, { guards: [SignedIn] })
     .param("taskId", ID)
     .exec(async function (taskId) {
       return await this.taskService.startTask(taskId);
     }),
-  reviewTask: prompt({ guards: [SignedIn], mcp: { expose: true } })
+  reviewTask: prompt({ guards: [SignedIn] })
     .param("taskId", ID)
     .exec(async function (taskId) {
       const task = await this.taskService.getTask(taskId);
@@ -518,24 +523,21 @@ export class TaskEndpoint extends endpoint(srv.task, ({ mutation, prompt }) => (
 })) {}
 ```
 
-- **The refusals are fail-closed and survive opting in**: `pubsub` and `message` (their internal args read a socket
-  an MCP request does not have), an `Any` or `Upload` return, a file upload, **a mutation with no real `guards`**
-  (`[Public]` is having none, spelled out — it answers true unconditionally), and **an argument typed `Any` that
-  must be filled**.
+- **The refusals are fail-closed**: **an endpoint that declares no `guards` at all** (nobody decided who may reach
+  it), **a mutation with no real `guards`** (`[Public]` is having none, spelled out — it answers true
+  unconditionally), `pubsub` and `message` (their internal args read a socket an MCP request does not have), an
+  `Any` or `Upload` return, a file upload, and **an argument typed `Any` that must be filled**.
   A `prompt` refuses two more, because its `arguments` is one string per name with no schema beside it: a **list
   argument**, which could never carry a second value, and **any `Any` argument** — a tool leaves that out of its
-  schema, and a prompt has no schema to leave it out of. `resource: true` is refused there too: only a read
-  publishes a resource template.
-- **Every refusal is named in the boot log**, and so is every published entry that declares no `guards` at all —
-  the access is what `[Public]` grants, but only one of the two is a decision you made. One `warn` per endpoint
-  plus a `MCP catalogue: tools=… prompts=…` count. Read that line first when a tool you exposed is missing —
-  fail-closed is right, and a silent fail-closed leaves you nothing to read. `akan quality scan` covers the two
-  shapes visible in source, `akan.mcp.missing-description` and `akan.mcp.unguarded-exposure`; the API explorer
-  badges the per-endpoint rules (`MCP` / `MCP refused`) from the same rule the catalogue runs.
+  schema, and a prompt has no schema to leave it out of.
+- **Every refusal is named in the boot log**: one `warn` per endpoint plus a `MCP catalogue: tools=… prompts=…`
+  count. Read that line first when a tool you expected is missing — and it is the *only* place the answer exists,
+  because there is no absent opt-in to notice. The API explorer badges the same rule per endpoint (`MCP` /
+  `MCP refused`), from the same shared implementation the catalogue runs.
 - **An `Any` argument is left out of the published schema** rather than described as `{}` — it tells a model
   nothing — and a value sent for one is refused by name, so the endpoint reads it as omitted. That is what happens
   to the root list's raw `query` descriptor: read as sent, it would be an arbitrary filter over every model you
-  exposed through `mcp: { list: true }`. Expose a named filter slice when an agent should narrow a list.
+  publish. Declare a named filter slice when an agent should narrow a list.
 - **A nullable model return publishes no `outputSchema`**, and its empty answer ships as the text `null` with no
   `structuredContent`. That field is an object by definition, so `null` cannot ride in it any more than an array
   can — a list is wrapped as `{ items: … }` for the same reason — and a declared schema obliges every result to
@@ -544,13 +546,13 @@ export class TaskEndpoint extends endpoint(srv.task, ({ mutation, prompt }) => (
 - **An `outputSchema` names no `hidden` or `secret` field.** Every response has both stripped, so publishing them
   promises a property no answer can carry — and on a model like `user` the names are the leak. Your *input* schema
   keeps them: they are legal to send, and the same model describes a request body.
-- An endpoint that did not opt in answers the *same* "unknown tool" as one that does not exist. Never make that
+- A refused endpoint answers the *same* "unknown tool" as one that does not exist. Never make that
   message more helpful — the difference is what enumerates your private surface. A guard's refusal is generalized
   the same way: the caller reads `You are not permitted to perform this action.`, never `Access denied by guard:
   Admin`, which names your authorization structure to the one caller barred from it. A domain `Err` resolves
   through the dictionary first and keeps its own words.
-- `mcp: { readOnly, destructive, idempotent }` only override the hints a client renders. Clients are told to
-  distrust hints; they are never a gate.
+- The `readOnly` / `destructive` / `idempotent` hints a client renders are derived from the endpoint type and key
+  and are not configurable. Clients are told to distrust hints; they are never a gate.
 - **`AKAN_MCP_READONLY=true` is the read-only-deployment valve, not the exposure switch.** It drops every mutation
   whatever it declared, and reports each one in the boot log like any other refusal.
 - OAuth resource metadata is published at `/.well-known/oauth-protected-resource` (and at that path plus the mount
@@ -558,12 +560,12 @@ export class TaskEndpoint extends endpoint(srv.task, ({ mutation, prompt }) => (
   configure it; `insufficient_scope` is enforced only once `AKAN_MCP_SCOPES` is set. A token carrying no `aud` at
   all is refused once `AKAN_MCP_AUTH_SERVERS` names an issuer — that issuer mints tokens for its other resources
   too — and accepted while none is named, because a first-party Akan token is bound by app and environment.
-- `akan quality scan` warns **`akan.mcp.missing-description`** for anything exposed without a dictionary `.desc()`.
-  An agent picks a tool by its description, so a missing one is a broken tool. What the framework generates is
-  exempt and borrows the model's own text, having none of its own: `mcp: { list: true }` reads the `.of()` label,
-  and the base CRUD tools append the model's `.desc()` to their generated `Get X`. Write that model `.desc()` — it
-  is the only text those entries can carry. The scan is not the whole answer either, because it reads source: **the
-  boot log names every published entry with no description**, generated ones included.
+- **The boot log names every published entry with no dictionary `.desc()`.** An agent picks a tool by its
+  description, so a missing one is a broken tool. What the framework generates has no text of its own and borrows
+  the model's: the generated list reads the `.of()` label, and the base CRUD tools append the model's `.desc()` to
+  their generated `Get X`. Write that model `.desc()` — it is the only text those entries can carry. There is no
+  `akan quality scan` rule for this any more: a source scanner found the exposure only as an `mcp:` literal, and
+  with exposure derived from the guards the resolved catalogue is the only place that can answer.
 - A browser-hosted client needs `allowedOrigins` **and** the CORS answer the server sends back for those origins.
   Every other MCP client sends no `Origin` at all, and the one that does is matched against the forwarded host so
   a proxy does not turn each call into a 403 — which is only as trustworthy as an edge that *overwrites* that
@@ -588,9 +590,8 @@ export class TaskEndpoint extends endpoint(srv.task, ({ mutation, prompt }) => (
   token signed wrong, like an opaque one, still degrades to an anonymous caller.
 - **Resource URIs**: `akan://<model>/{id}`, `akan://<model>/light/{id}`, `akan://<model>/list` for the model's own
   list, and `akan://<model>/list/<sliceKey>` for a slice's. The root list takes no third segment on purpose — any
-  token there is one a slice could also be named. **Those four are the whole set**, so `mcp: { resource: true }`
-  is honoured only on the generated reads: a custom endpoint keeps its tool, gets no resource template, and is
-  named in the boot log saying so.
+  token there is one a slice could also be named. **Those four are the whole set**, so only the generated reads are
+  addressable: a custom endpoint keeps its tool and gets no resource template.
 - **The catalogue is one language**, `en` unless `language` says otherwise: it is built once at boot and cached by
   clients, so there is no `Accept-Language` negotiation.
 

package/guidelines/workspaceOnboarding/workspaceOnboarding.instruction.md

@@ -459,9 +459,7 @@ is convention that keeps hand-written code reading like generated code.
   generated. Never `import type { RootStore } from "../st"` — it crashes `akan build` with a Bun SSR segfault.
 - **`dictionary.ts`** — fixed chain with empty stages still written:
   `.of() → .model() → .insight() → .query() → .sort() → .enum() → .slice() → .endpoint() → .error() → .translate()`.
-  Every label is `t(["English", "한국어"])`, and nearly every one also carries `.desc([en, ko])`. One optional stage,
-  `.store()`, sits between `.endpoint()` and `.error()` for custom store actions whose name differs from the
-  endpoint they call — omit it rather than writing it empty.
+  Every label is `t(["English", "한국어"])`, and nearly every one also carries `.desc([en, ko])`.
 - **`srvkit/` adapters** — an injected singleton is an `adapt("name" as const, ({ use, env, plug, memory }) => ({…}))`
   class, injected with `plug(TheClass)`. It self-registers, so do not add it to `lib/option.ts`. `this.logger` is
   provided; lifecycle work goes in `override async onInit()`. A per-use value object stays a plain class you `new` at

package/index.js

@@ -31,7 +31,7 @@ var commandModules = {
   guideline: async () => (await import("./guideline.command-0jj2k77g.js")).GuidelineCommand,
   scalar: async () => (await import("./scalar.command-xdjhvsgb.js")).ScalarCommand,
   primitive: async () => (await import("./primitive.command-7qbdhfc2.js")).PrimitiveCommand,
-  quality: async () => (await import("./quality.command-1ff2xcra.js")).QualityCommand,
+  quality: async () => (await import("./quality.command-51q9kmhj.js")).QualityCommand,
   repair: async () => (await import("./repair.command-weakn0yr.js")).RepairCommand,
   workflow: async () => (await import("./workflow.command-msm2tjee.js")).WorkflowCommand
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akanjs/cli",
-  "version": "3.0.0-alpha.15",
+  "version": "3.0.0-alpha.16",
   "sourceType": "module",
   "type": "module",
   "publishConfig": {
@@ -34,7 +34,7 @@
     "@langchain/openai": "^1.4.6",
     "@tailwindcss/node": "^4.3.0",
     "@trapezedev/project": "^7.1.4",
-    "akanjs": "3.0.0-alpha.15",
+    "akanjs": "3.0.0-alpha.16",
     "chalk": "^5.6.2",
     "commander": "^14.0.3",
     "dayjs": "^1.11.20",

package/{quality.command-1ff2xcra.js → quality.command-51q9kmhj.js}

@@ -20,163 +20,13 @@ import"./index-r24hmh0q.js";
 // pkgs/@akanjs/devkit/qualityScanner.ts
 import { createHash } from "crypto";
 import { readdir, readFile, stat } from "fs/promises";
-import path3 from "path";
+import path from "path";
 import { RESERVED_ROUTE_CONFIG_EXPORTS } from "akanjs/common";
 import ignore from "ignore";
-import ts4 from "typescript";
-
-// pkgs/@akanjs/devkit/mcpScanner.ts
-import path from "path";
-import ts from "typescript";
-
-class McpScanner {
-  scan(sourceFiles) {
-    const dictionaries = new Map(sourceFiles.filter((sourceFile) => sourceFile.file.endsWith(".dictionary.ts")).map((sourceFile) => [path.dirname(sourceFile.file), sourceFile]));
-    return sourceFiles.filter((sourceFile) => sourceFile.file.endsWith(".signal.ts")).flatMap((sourceFile) => this.#scanSignal(sourceFile, dictionaries.get(path.dirname(sourceFile.file))));
-  }
-  #scanSignal(signal, dictionary) {
-    const exposed = McpScanner.#exposedDeclarations(signal);
-    if (!exposed.length)
-      return [];
-    const refName = path.basename(signal.file, ".signal.ts").replace(/^_+/, "");
-    const described = dictionary ? McpScanner.#describedEntries(dictionary) : new Map;
-    return [
-      ...exposed.filter(({ name, kind }) => !McpScanner.#isDescribed(described, refName, name, kind)).map(({ name, kind, line }) => ({
-        rule: "akan.mcp.missing-description",
-        scope: "mcp",
-        severity: "warning",
-        file: signal.file,
-        line,
-        message: `MCP-exposed ${kind} "${name}" has no dictionary .desc(); an agent sees its name and nothing else.`
-      })),
-      ...exposed.filter(({ guards }) => guards === "missing").map(({ name, kind, line }) => ({
-        rule: "akan.mcp.unguarded-exposure",
-        scope: "mcp",
-        severity: "warning",
-        file: signal.file,
-        line,
-        message: `MCP-exposed ${kind} "${name}" declares no guards; a slice's guards map never reaches a named slice.`
-      }))
-    ];
-  }
-  static #isDescribed(described, refName, name, kind) {
-    if (described.get(kind)?.has(name))
-      return true;
-    return kind === "slice" && !!described.get("endpoint")?.has(`${refName}List${McpScanner.#capitalize(name)}`);
-  }
-  static #exposedDeclarations(signal) {
-    const found = [];
-    const visit = (node) => {
-      if (McpScanner.#isExposeOption(node)) {
-        const declaration = McpScanner.#enclosingDeclaration(node, signal.sourceFile);
-        if (declaration)
-          found.push(declaration);
-      }
-      ts.forEachChild(node, visit);
-    };
-    visit(signal.sourceFile);
-    return found;
-  }
-  static #isExposeOption(node) {
-    if (!ts.isPropertyAssignment(node) || McpScanner.#propertyName(node) !== "mcp")
-      return false;
-    if (!ts.isObjectLiteralExpression(node.initializer))
-      return false;
-    return node.initializer.properties.some((property) => ts.isPropertyAssignment(property) && McpScanner.#propertyName(property) === "expose" && property.initializer.kind === ts.SyntaxKind.TrueKeyword);
-  }
-  static #enclosingDeclaration(option, sourceFile) {
-    let declaration = null;
-    for (let node = option.parent;node; node = node.parent) {
-      if (!declaration && ts.isPropertyAssignment(node)) {
-        declaration = node;
-        continue;
-      }
-      const kind = McpScanner.#factoryKind(node);
-      if (!kind || !declaration)
-        continue;
-      const name = McpScanner.#propertyName(declaration);
-      if (!name)
-        return null;
-      const line = sourceFile.getLineAndCharacterOfPosition(declaration.getStart(sourceFile)).line + 1;
-      return { name, kind, line, guards: McpScanner.#guardState(option) };
-    }
-    return null;
-  }
-  static #guardState(option) {
-    const options = option.parent;
-    if (!ts.isObjectLiteralExpression(options))
-      return "unknown";
-    if (options.properties.some((property) => ts.isSpreadAssignment(property)))
-      return "unknown";
-    return options.properties.some((property) => ts.isPropertyAssignment(property) && McpScanner.#propertyName(property) === "guards") ? "declared" : "missing";
-  }
-  static #factoryKind(node) {
-    if (!ts.isCallExpression(node) || !ts.isIdentifier(node.expression))
-      return null;
-    const factory = node.expression.text;
-    return factory === "slice" || factory === "endpoint" ? factory : null;
-  }
-  static #describedEntries(dictionary) {
-    const described = new Map;
-    const visit = (node) => {
-      const stage = McpScanner.#dictionaryStage(node);
-      if (stage) {
-        for (const [name, chain] of McpScanner.#stageEntries(node)) {
-          if (!chain.has("desc"))
-            continue;
-          const names = described.get(stage) ?? new Set;
-          names.add(name);
-          described.set(stage, names);
-        }
-      }
-      ts.forEachChild(node, visit);
-    };
-    visit(dictionary.sourceFile);
-    return described;
-  }
-  static #dictionaryStage(node) {
-    if (!ts.isCallExpression(node) || !ts.isPropertyAccessExpression(node.expression))
-      return null;
-    const stage = node.expression.name.text;
-    return stage === "endpoint" || stage === "slice" ? stage : null;
-  }
-  static #stageEntries(stage) {
-    const callback = stage.arguments[0];
-    if (!callback || !ts.isArrowFunction(callback))
-      return [];
-    const body = ts.isParenthesizedExpression(callback.body) ? callback.body.expression : callback.body;
-    if (!ts.isObjectLiteralExpression(body))
-      return [];
-    return body.properties.flatMap((property) => {
-      if (!ts.isPropertyAssignment(property))
-        return [];
-      const name = McpScanner.#propertyName(property);
-      return name ? [[name, McpScanner.#chainCalls(property.initializer)]] : [];
-    });
-  }
-  static #chainCalls(expression) {
-    const calls = new Set;
-    let current = expression;
-    while (ts.isCallExpression(current) || ts.isPropertyAccessExpression(current)) {
-      if (ts.isPropertyAccessExpression(current))
-        calls.add(current.name.text);
-      current = current.expression;
-    }
-    return calls;
-  }
-  static #propertyName(property) {
-    const { name } = property;
-    if (ts.isIdentifier(name) || ts.isStringLiteral(name))
-      return name.text;
-    return null;
-  }
-  static #capitalize(value) {
-    return value.charAt(0).toUpperCase() + value.slice(1);
-  }
-}
+import ts2 from "typescript";
 
 // pkgs/@akanjs/devkit/ssrScanner.ts
-import ts2 from "typescript";
+import ts from "typescript";
 var STATIC_COMPONENT_MIN_MASS = 4;
 var MIXED_COMPONENT_MIN_MASS = 10;
 var MIXED_COMPONENT_MAX_TOUCHES = 2;
@@ -294,31 +144,31 @@ class SsrScanner {
           });
         }
       }
-      ts2.forEachChild(node, visit);
+      ts.forEachChild(node, visit);
     };
-    ts2.forEachChild(sourceFile.sourceFile, visit);
+    ts.forEachChild(sourceFile.sourceFile, visit);
     return warnings;
   }
   #isMountEffect(sourceFile, node) {
-    if (!ts2.isCallExpression(node))
+    if (!ts.isCallExpression(node))
       return false;
     const callee = node.expression.getText(sourceFile);
     if (callee !== "useEffect" && callee !== "useLayoutEffect")
       return false;
     const deps = node.arguments[1];
-    return !!deps && ts2.isArrayLiteralExpression(deps) && deps.elements.length === 0;
+    return !!deps && ts.isArrayLiteralExpression(deps) && deps.elements.length === 0;
   }
   #getLoadCalls(sourceFile, node) {
     const calls = [];
     const visit = (child) => {
-      if (ts2.isCallExpression(child)) {
+      if (ts.isCallExpression(child)) {
         const callee = child.expression.getText(sourceFile);
         if (/^fetch\.[a-z]/.test(callee) || /^st\.do\.(init|get|view|load|list|count|insight)[A-Z]/.test(callee))
           calls.push({ callee, node: child });
       }
-      ts2.forEachChild(child, visit);
+      ts.forEachChild(child, visit);
     };
-    ts2.forEachChild(node, visit);
+    ts.forEachChild(node, visit);
     return calls;
   }
   #getTemplateStateWarnings(sourceFile) {
@@ -326,7 +176,7 @@ class SsrScanner {
       return [];
     const warnings = [];
     const visit = (node) => {
-      if (ts2.isCallExpression(node) && node.expression.getText(sourceFile.sourceFile) === "useState") {
+      if (ts.isCallExpression(node) && node.expression.getText(sourceFile.sourceFile) === "useState") {
         warnings.push({
           rule: "akan.ssr.template-client-state",
           scope: "ssr",
@@ -336,9 +186,9 @@ class SsrScanner {
           message: "Template holds form state in useState. Templates are store-driven and carry no local state."
         });
       }
-      ts2.forEachChild(node, visit);
+      ts.forEachChild(node, visit);
     };
-    ts2.forEachChild(sourceFile.sourceFile, visit);
+    ts.forEachChild(sourceFile.sourceFile, visit);
     return warnings;
   }
   #measureBalance(sourceFiles) {
@@ -379,14 +229,14 @@ class SsrScanner {
     return components;
   }
   #getComponentNodes(statement) {
-    if (ts2.isFunctionDeclaration(statement) && statement.body)
+    if (ts.isFunctionDeclaration(statement) && statement.body)
       return [{ name: statement.name?.text ?? "default", node: statement.body }];
-    if (!ts2.isVariableStatement(statement))
+    if (!ts.isVariableStatement(statement))
       return [];
     return statement.declarationList.declarations.flatMap((declaration) => {
-      if (!ts2.isIdentifier(declaration.name) || !declaration.initializer)
+      if (!ts.isIdentifier(declaration.name) || !declaration.initializer)
         return [];
-      if (!ts2.isArrowFunction(declaration.initializer) && !ts2.isFunctionExpression(declaration.initializer))
+      if (!ts.isArrowFunction(declaration.initializer) && !ts.isFunctionExpression(declaration.initializer))
         return [];
       return [{ name: declaration.name.text, node: declaration.initializer }];
     });
@@ -394,7 +244,7 @@ class SsrScanner {
   #getTouches(sourceFile, node) {
     const touches = [];
     const visit = (child) => {
-      if (ts2.isCallExpression(child)) {
+      if (ts.isCallExpression(child)) {
         const callee = child.expression.getText(sourceFile);
         const bareName = callee.split(".").pop() ?? callee;
         if (callee === "createContext" || callee === "lazy")
@@ -402,60 +252,60 @@ class SsrScanner {
         else if (/^use[A-Z]/.test(bareName) && !SsrScanner.#serverSafeCalls.has(bareName))
           touches.push(bareName);
       }
-      if (ts2.isJsxAttribute(child) && /^on[A-Z]/.test(child.name.getText(sourceFile)))
+      if (ts.isJsxAttribute(child) && /^on[A-Z]/.test(child.name.getText(sourceFile)))
         touches.push(child.name.getText(sourceFile));
-      if (ts2.isPropertyAccessExpression(child)) {
+      if (ts.isPropertyAccessExpression(child)) {
         const root = getAccessRoot(child);
         if (root === "st")
           touches.push("st");
         else if (SsrScanner.#clientGlobals.has(root))
           touches.push(root);
       }
-      ts2.forEachChild(child, visit);
+      ts.forEachChild(child, visit);
     };
-    ts2.forEachChild(node, visit);
+    ts.forEachChild(node, visit);
     return touches;
   }
   #getTagNames(sourceFile, node) {
     const tags = new Set;
     const visit = (child) => {
-      if (ts2.isJsxOpeningElement(child) || ts2.isJsxSelfClosingElement(child))
+      if (ts.isJsxOpeningElement(child) || ts.isJsxSelfClosingElement(child))
         tags.add(child.tagName.getText(sourceFile).split(".")[0]);
-      ts2.forEachChild(child, visit);
+      ts.forEachChild(child, visit);
     };
-    ts2.forEachChild(node, visit);
+    ts.forEachChild(node, visit);
     return tags;
   }
   #getMass(node) {
     let mass = 0;
     const visit = (child) => {
-      if (ts2.isJsxOpeningElement(child) || ts2.isJsxSelfClosingElement(child))
+      if (ts.isJsxOpeningElement(child) || ts.isJsxSelfClosingElement(child))
         mass += 1;
-      ts2.forEachChild(child, visit);
+      ts.forEachChild(child, visit);
     };
-    ts2.forEachChild(node, visit);
+    ts.forEachChild(node, visit);
     return mass;
   }
   #hasUseClient(sourceFile) {
     const first = sourceFile.statements[0];
-    if (!first || !ts2.isExpressionStatement(first) || !ts2.isStringLiteral(first.expression))
+    if (!first || !ts.isExpressionStatement(first) || !ts.isStringLiteral(first.expression))
       return false;
     return first.expression.text === "use client";
   }
   #hasVendorImport(sourceFile) {
-    return sourceFile.statements.some((statement) => ts2.isImportDeclaration(statement) && isVendorSpecifier(getSpecifier(statement)));
+    return sourceFile.statements.some((statement) => ts.isImportDeclaration(statement) && isVendorSpecifier(getSpecifier(statement)));
   }
   #getVendorNames(sourceFile) {
     const names = new Set;
     for (const statement of sourceFile.statements) {
-      if (!ts2.isImportDeclaration(statement) || !isVendorSpecifier(getSpecifier(statement)))
+      if (!ts.isImportDeclaration(statement) || !isVendorSpecifier(getSpecifier(statement)))
         continue;
       const clause = statement.importClause;
       if (clause?.name)
         names.add(clause.name.text);
-      if (clause?.namedBindings && ts2.isNamespaceImport(clause.namedBindings))
+      if (clause?.namedBindings && ts.isNamespaceImport(clause.namedBindings))
         names.add(clause.namedBindings.name.text);
-      if (clause?.namedBindings && ts2.isNamedImports(clause.namedBindings))
+      if (clause?.namedBindings && ts.isNamedImports(clause.namedBindings))
         for (const element of clause.namedBindings.elements)
           names.add(element.name.text);
     }
@@ -463,10 +313,10 @@ class SsrScanner {
   }
   #importsClientRuntime(sourceFile) {
     for (const statement of sourceFile.statements) {
-      if (!ts2.isImportDeclaration(statement))
+      if (!ts.isImportDeclaration(statement))
         continue;
       const bindings = statement.importClause?.namedBindings;
-      if (!bindings || !ts2.isNamedImports(bindings))
+      if (!bindings || !ts.isNamedImports(bindings))
         continue;
       if (bindings.elements.some((element) => SsrScanner.#clientRuntimeImports.has(element.name.text)))
         return true;
@@ -517,7 +367,7 @@ function getShare(serverMass, clientMass) {
   return total === 0 ? 1 : serverMass / total;
 }
 function getSpecifier(statement) {
-  return ts2.isStringLiteral(statement.moduleSpecifier) ? statement.moduleSpecifier.text : "";
+  return ts.isStringLiteral(statement.moduleSpecifier) ? statement.moduleSpecifier.text : "";
 }
 function isVendorSpecifier(specifier) {
   if (specifier === "" || specifier.startsWith(".") || specifier.startsWith("/"))
@@ -530,125 +380,9 @@ function isVendorSpecifier(specifier) {
 }
 function getAccessRoot(node) {
   let current = node;
-  while (ts2.isPropertyAccessExpression(current))
+  while (ts.isPropertyAccessExpression(current))
     current = current.expression;
-  return ts2.isIdentifier(current) ? current.text : "";
-}
-
-// pkgs/@akanjs/devkit/storeScanner.ts
-import path2 from "path";
-import ts3 from "typescript";
-
-class StoreScanner {
-  scan(sourceFiles) {
-    const dictionaries = new Map(sourceFiles.filter((sourceFile) => sourceFile.file.endsWith(".dictionary.ts")).map((sourceFile) => [path2.dirname(sourceFile.file), sourceFile]));
-    return sourceFiles.filter((sourceFile) => sourceFile.file.endsWith(".store.ts")).flatMap((sourceFile) => this.#scanStore(sourceFile, dictionaries.get(path2.dirname(sourceFile.file))));
-  }
-  #scanStore(store, dictionary) {
-    const actions = StoreScanner.#customActions(store);
-    if (!actions.length)
-      return [];
-    const described = dictionary ? StoreScanner.#describedEntries(dictionary) : new Map;
-    return actions.filter(({ name, fetched }) => fetched.length && !fetched.includes(name)).filter(({ name }) => !described.get("store")?.has(name) && !described.get("endpoint")?.has(name)).map(({ name, line, fetched }) => ({
-      rule: "akan.agent.missing-store-description",
-      scope: "agent",
-      severity: "warning",
-      file: store.file,
-      line,
-      message: `Store action "${name}" calls ${fetched.map((key) => `${key}()`).join(", ")} under a different name and has no dictionary .store() entry, so an agent reading it has the name and nothing else.`
-    }));
-  }
-  static #customActions(store) {
-    const actions = [];
-    const visit = (node) => {
-      if (ts3.isClassDeclaration(node) && StoreScanner.#extendsStore(node)) {
-        for (const member of node.members) {
-          if (!ts3.isMethodDeclaration(member))
-            continue;
-          if (member.modifiers?.some((modifier) => modifier.kind === ts3.SyntaxKind.StaticKeyword))
-            continue;
-          const name = StoreScanner.#memberName(member);
-          if (!name)
-            continue;
-          const line = store.sourceFile.getLineAndCharacterOfPosition(member.getStart(store.sourceFile)).line + 1;
-          actions.push({ name, line, fetched: StoreScanner.#fetchedEndpoints(member) });
-        }
-      }
-      ts3.forEachChild(node, visit);
-    };
-    visit(store.sourceFile);
-    return actions;
-  }
-  static #extendsStore(node) {
-    return !!node.heritageClauses?.some((clause) => clause.types.some((type) => ts3.isCallExpression(type.expression) && StoreScanner.#isStoreCall(type.expression)));
-  }
-  static #isStoreCall(expression) {
-    return ts3.isIdentifier(expression.expression) && expression.expression.text === "store";
-  }
-  static #fetchedEndpoints(member) {
-    const fetched = new Set;
-    const visit = (node) => {
-      if (ts3.isCallExpression(node) && ts3.isPropertyAccessExpression(node.expression) && ts3.isIdentifier(node.expression.expression) && node.expression.expression.text === "fetch")
-        fetched.add(node.expression.name.text);
-      ts3.forEachChild(node, visit);
-    };
-    visit(member);
-    return [...fetched];
-  }
-  static #describedEntries(dictionary) {
-    const described = new Map;
-    const visit = (node) => {
-      const stage = StoreScanner.#dictionaryStage(node);
-      if (stage) {
-        for (const [name, chain] of StoreScanner.#stageEntries(node)) {
-          if (!chain.has("desc"))
-            continue;
-          const names = described.get(stage) ?? new Set;
-          names.add(name);
-          described.set(stage, names);
-        }
-      }
-      ts3.forEachChild(node, visit);
-    };
-    visit(dictionary.sourceFile);
-    return described;
-  }
-  static #dictionaryStage(node) {
-    if (!ts3.isCallExpression(node) || !ts3.isPropertyAccessExpression(node.expression))
-      return null;
-    const stage = node.expression.name.text;
-    return stage === "store" || stage === "endpoint" ? stage : null;
-  }
-  static #stageEntries(stage) {
-    const callback = stage.arguments[0];
-    if (!callback || !ts3.isArrowFunction(callback))
-      return [];
-    const body = ts3.isParenthesizedExpression(callback.body) ? callback.body.expression : callback.body;
-    if (!ts3.isObjectLiteralExpression(body))
-      return [];
-    return body.properties.flatMap((property) => {
-      if (!ts3.isPropertyAssignment(property))
-        return [];
-      const name = StoreScanner.#memberName(property);
-      return name ? [[name, StoreScanner.#chainCalls(property.initializer)]] : [];
-    });
-  }
-  static #chainCalls(expression) {
-    const calls = new Set;
-    let current = expression;
-    while (ts3.isCallExpression(current) || ts3.isPropertyAccessExpression(current)) {
-      if (ts3.isPropertyAccessExpression(current))
-        calls.add(current.name.text);
-      current = current.expression;
-    }
-    return calls;
-  }
-  static #memberName(member) {
-    const { name } = member;
-    if (!name || !ts3.isIdentifier(name) && !ts3.isStringLiteral(name))
-      return null;
-    return name.text;
-  }
+  return ts.isIdentifier(current) ? current.text : "";
 }
 
 // pkgs/@akanjs/devkit/qualityScanner.ts
@@ -705,10 +439,7 @@ var RULE_FIXES = {
   "akan.ssr.client-static-markup": "Keep the interactive element in the client component and hoist the static subtree into a server component, then accept it as `children` or render it through a Unit/View reference.",
   "akan.ssr.client-mount-load": "Load the data in the route with `fetch.initX(...)` / `fetch.viewX(...)` and pass the init/view object down as a prop; the client store hydrates from it and the effect goes away.",
   "akan.ssr.module-missing-server-view": "Add a <Model>.Unit.tsx for list/card rendering and a <Model>.View.tsx for the detail surface, then have the Zone delegate to them.",
-  "akan.ssr.template-client-state": "Bind the field to the store instead: `value={xForm.field}` with `onChange={st.do.setFieldOnX}`.",
-  "akan.mcp.missing-description": "Add `.desc([en, ko])` to this entry in the module's dictionary \u2014 for a slice, either on the slice entry or on the `<model>List<Slice>` endpoint it generates. Describe when to reach for it, not what it is named.",
-  "akan.agent.missing-store-description": "Add the action to the module dictionary's `.store()` stage with a `.desc([en, ko])` saying what it does for the user \u2014 not what the endpoint it calls does. That stage is optional everywhere else: an action named after its endpoint already reads as that endpoint's description.",
-  "akan.mcp.unguarded-exposure": "Name the guards in the same option object as `mcp`: `init({ guards: [SignedIn], mcp: { expose: true } })`. Write `guards: [Public]` if anonymous reads are the intent \u2014 the access is the same, but only one of the two is a decision. The `slice()` call's guards map reaches the root slice and base CRUD, never a named slice."
+  "akan.ssr.template-client-state": "Bind the field to the store instead: `value={xForm.field}` with `onChange={st.do.setFieldOnX}`."
 };
 function getRuleFix(rule) {
   if (rule.startsWith("akan.convention"))
@@ -729,9 +460,7 @@ class AkanQualityScanner {
       ...sourceFiles.flatMap((sourceFile) => this.#scanConventionQuality(sourceFile)),
       ...sourceFiles.flatMap((sourceFile) => this.#scanLayoutQuality(sourceFile)),
       ...abstractFiles.flatMap((abstractFile) => this.#scanAbstractQuality(abstractFile)),
-      ...ssr.warnings,
-      ...new McpScanner().scan(sourceFiles),
-      ...new StoreScanner().scan(sourceFiles)
+      ...ssr.warnings
     ];
     return {
       workspaceRoot,
@@ -745,7 +474,7 @@ class AkanQualityScanner {
     const ignoreFilter = ignore().add(await this.#readGitIgnore(workspaceRoot));
     const files = [];
     for (const targetRoot of ["apps", "libs"]) {
-      const absoluteTargetRoot = path3.join(workspaceRoot, targetRoot);
+      const absoluteTargetRoot = path.join(workspaceRoot, targetRoot);
       if (!await isDirectory(absoluteTargetRoot))
         continue;
       await this.#walkTargetFiles(workspaceRoot, absoluteTargetRoot, ignoreFilter, files);
@@ -753,7 +482,7 @@ class AkanQualityScanner {
     return files.sort();
   }
   async#readGitIgnore(workspaceRoot) {
-    const gitIgnorePath = path3.join(workspaceRoot, ".gitignore");
+    const gitIgnorePath = path.join(workspaceRoot, ".gitignore");
     if (!await Bun.file(gitIgnorePath).exists())
       return [];
     return (await readFile(gitIgnorePath, "utf8")).split(/\r?\n/);
@@ -761,8 +490,8 @@ class AkanQualityScanner {
   async#walkTargetFiles(workspaceRoot, currentPath, ignoreFilter, files) {
     const entries = await readdir(currentPath, { withFileTypes: true });
     for (const entry of entries) {
-      const absolutePath = path3.join(currentPath, entry.name);
-      const relativePath = toPosix(path3.relative(workspaceRoot, absolutePath));
+      const absolutePath = path.join(currentPath, entry.name);
+      const relativePath = toPosix(path.relative(workspaceRoot, absolutePath));
       if (shouldSkipPath(relativePath, entry.isDirectory(), ignoreFilter))
         continue;
       if (entry.isDirectory()) {
@@ -777,17 +506,17 @@ class AkanQualityScanner {
     }
   }
   async#readSourceFile(workspaceRoot, file) {
-    const absolutePath = path3.join(workspaceRoot, file);
+    const absolutePath = path.join(workspaceRoot, file);
     const content = await readFile(absolutePath, "utf8");
     return {
       file,
       absolutePath,
       content,
-      sourceFile: ts4.createSourceFile(file, content, ts4.ScriptTarget.Latest, true, getScriptKind(file))
+      sourceFile: ts2.createSourceFile(file, content, ts2.ScriptTarget.Latest, true, getScriptKind(file))
     };
   }
   async#readTextFile(workspaceRoot, file) {
-    return { file, content: await readFile(path3.join(workspaceRoot, file), "utf8") };
+    return { file, content: await readFile(path.join(workspaceRoot, file), "utf8") };
   }
   #scanGlobalQuality(sourceFiles) {
     const exportedFunctionLikes = sourceFiles.flatMap((sourceFile) => getExportedFunctionLikes(sourceFile));
@@ -911,7 +640,7 @@ class AkanQualityScanner {
     const suffix = CONVENTION_SUFFIXES.find((candidate) => sourceFile.file.endsWith(candidate));
     if (!suffix)
       return [];
-    const modelName = toPascalCase(path3.basename(sourceFile.file, suffix));
+    const modelName = toPascalCase(path.basename(sourceFile.file, suffix));
     const warnings = [];
     for (const declaration of getTopLevelDeclarations(sourceFile)) {
       if (isAllowedConventionDeclaration(suffix, modelName, declaration))
@@ -922,7 +651,7 @@ class AkanQualityScanner {
         severity: "warning",
         file: sourceFile.file,
         line: declaration.line,
-        message: `${path3.basename(sourceFile.file)} should not declare top-level ${declaration.kind} "${declaration.name}". Allowed declarations: ${getConventionDescription(suffix, modelName)}.`
+        message: `${path.basename(sourceFile.file)} should not declare top-level ${declaration.kind} "${declaration.name}". Allowed declarations: ${getConventionDescription(suffix, modelName)}.`
       });
     }
     return warnings;
@@ -1030,7 +759,7 @@ function getExportedFunctionLikes(sourceFile) {
   const declarations = [];
   const nameExempt = isPageRouteFile(sourceFile.file) || isUiComponentFile(sourceFile.file);
   for (const statement of sourceFile.sourceFile.statements) {
-    if (ts4.isFunctionDeclaration(statement) && statement.name && isExported(statement)) {
+    if (ts2.isFunctionDeclaration(statement) && statement.name && isExported(statement)) {
       declarations.push({
         name: statement.name.text,
         kind: "function",
@@ -1040,7 +769,7 @@ function getExportedFunctionLikes(sourceFile) {
         duplicateNameExempt: nameExempt || isConventionDuplicateNameExempt(sourceFile.file, false)
       });
     }
-    if (ts4.isClassDeclaration(statement) && statement.name && isExported(statement)) {
+    if (ts2.isClassDeclaration(statement) && statement.name && isExported(statement)) {
       declarations.push({
         name: statement.name.text,
         kind: "class",
@@ -1050,9 +779,9 @@ function getExportedFunctionLikes(sourceFile) {
         duplicateNameExempt: nameExempt || isConventionDuplicateNameExempt(sourceFile.file, isEnumClassStatement(sourceFile.sourceFile, statement))
       });
     }
-    if (ts4.isVariableStatement(statement) && isExported(statement)) {
+    if (ts2.isVariableStatement(statement) && isExported(statement)) {
       for (const declaration of statement.declarationList.declarations) {
-        if (!ts4.isIdentifier(declaration.name) || !isFunctionLikeInitializer(declaration.initializer))
+        if (!ts2.isIdentifier(declaration.name) || !isFunctionLikeInitializer(declaration.initializer))
           continue;
         declarations.push({
           name: declaration.name.text,
@@ -1091,14 +820,14 @@ function isInLibModule(file) {
   return (segments[0] === "apps" || segments[0] === "libs") && segments.includes("lib");
 }
 function isEnumClassStatement(sourceFile, statement) {
-  if (!ts4.isClassDeclaration(statement))
+  if (!ts2.isClassDeclaration(statement))
     return false;
-  const heritageClause = statement.heritageClauses?.find((clause) => clause.token === ts4.SyntaxKind.ExtendsKeyword);
+  const heritageClause = statement.heritageClauses?.find((clause) => clause.token === ts2.SyntaxKind.ExtendsKeyword);
   const expression = heritageClause?.types[0]?.expression;
   return !!expression && expression.getText(sourceFile).startsWith("enumOf(");
 }
 function getExportedClassNames(sourceFile) {
-  return sourceFile.statements.filter((statement) => ts4.isClassDeclaration(statement) && !!statement.name).filter((statement) => isExported(statement)).map((statement) => statement.name.text);
+  return sourceFile.statements.filter((statement) => ts2.isClassDeclaration(statement) && !!statement.name).filter((statement) => isExported(statement)).map((statement) => statement.name.text);
 }
 function isComponentDeclarationFile(file) {
   if (!file.endsWith(".tsx"))
@@ -1114,7 +843,7 @@ function isComponentDeclarationFile(file) {
 function getComponentFileDeclarations(sourceFile) {
   const reExportedNames = new Set;
   for (const statement of sourceFile.statements) {
-    if (ts4.isExportDeclaration(statement) && statement.exportClause && ts4.isNamedExports(statement.exportClause)) {
+    if (ts2.isExportDeclaration(statement) && statement.exportClause && ts2.isNamedExports(statement.exportClause)) {
       for (const element of statement.exportClause.elements)
         reExportedNames.add((element.propertyName ?? element.name).text);
     }
@@ -1124,19 +853,19 @@ function getComponentFileDeclarations(sourceFile) {
     const isDefaultExport = isDefaultExportStatement(statement);
     const inlineExported = isExported(statement);
     const add = (name, kind, line) => declarations.push({ name, kind, line, exported: inlineExported || reExportedNames.has(name), isDefaultExport });
-    if (ts4.isInterfaceDeclaration(statement))
+    if (ts2.isInterfaceDeclaration(statement))
       add(statement.name.text, "interface", getLine(sourceFile, statement));
-    else if (ts4.isTypeAliasDeclaration(statement))
+    else if (ts2.isTypeAliasDeclaration(statement))
       add(statement.name.text, "type", getLine(sourceFile, statement));
-    else if (ts4.isEnumDeclaration(statement))
+    else if (ts2.isEnumDeclaration(statement))
       add(statement.name.text, "enum", getLine(sourceFile, statement));
-    else if (ts4.isFunctionDeclaration(statement) && statement.name)
+    else if (ts2.isFunctionDeclaration(statement) && statement.name)
       add(statement.name.text, "function", getLine(sourceFile, statement));
-    else if (ts4.isClassDeclaration(statement) && statement.name)
+    else if (ts2.isClassDeclaration(statement) && statement.name)
       add(statement.name.text, "class", getLine(sourceFile, statement));
-    else if (ts4.isVariableStatement(statement)) {
+    else if (ts2.isVariableStatement(statement)) {
       for (const declaration of statement.declarationList.declarations) {
-        if (!ts4.isIdentifier(declaration.name))
+        if (!ts2.isIdentifier(declaration.name))
           continue;
         const kind = isFunctionLikeInitializer(declaration.initializer) ? "function" : "variable";
         add(declaration.name.text, kind, getLine(sourceFile, declaration));
@@ -1148,15 +877,15 @@ function getComponentFileDeclarations(sourceFile) {
 function getCompoundComponentNames(sourceFile) {
   const names = new Set;
   for (const statement of sourceFile.statements) {
-    if (!ts4.isExpressionStatement(statement))
+    if (!ts2.isExpressionStatement(statement))
       continue;
     const { expression } = statement;
-    if (!ts4.isBinaryExpression(expression) || expression.operatorToken.kind !== ts4.SyntaxKind.EqualsToken)
+    if (!ts2.isBinaryExpression(expression) || expression.operatorToken.kind !== ts2.SyntaxKind.EqualsToken)
       continue;
-    if (!ts4.isPropertyAccessExpression(expression.left) || !isPascalCaseName(expression.left.name.text))
+    if (!ts2.isPropertyAccessExpression(expression.left) || !isPascalCaseName(expression.left.name.text))
       continue;
     names.add(expression.left.name.text);
-    if (ts4.isIdentifier(expression.right) && isPascalCaseName(expression.right.text))
+    if (ts2.isIdentifier(expression.right) && isPascalCaseName(expression.right.text))
       names.add(expression.right.text);
   }
   return names;
@@ -1176,9 +905,9 @@ function isPascalCaseName(name) {
   return /^[A-Z]/.test(name) && !/^[A-Z0-9_]+$/.test(name);
 }
 function isDefaultExportStatement(statement) {
-  if (ts4.isExportAssignment(statement))
+  if (ts2.isExportAssignment(statement))
     return !statement.isExportEquals;
-  return !!(ts4.getCombinedModifierFlags(statement) & ts4.ModifierFlags.Default);
+  return !!(ts2.getCombinedModifierFlags(statement) & ts2.ModifierFlags.Default);
 }
 function getPlaceholderExportWarnings(sourceFile) {
   if (!sourceFile.file.endsWith("/index.ts") && !sourceFile.file.endsWith("/index.tsx"))
@@ -1208,7 +937,7 @@ function getDictionaryTextWarnings(sourceFile) {
 function getGlobalMutationWarnings(sourceFile) {
   const warnings = [];
   for (const statement of sourceFile.sourceFile.statements) {
-    if (ts4.isModuleDeclaration(statement) && statement.name.getText(sourceFile.sourceFile) === "global") {
+    if (ts2.isModuleDeclaration(statement) && statement.name.getText(sourceFile.sourceFile) === "global") {
       warnings.push({
         rule: "akan.file.global-declaration",
         scope: "file",
@@ -1218,7 +947,7 @@ function getGlobalMutationWarnings(sourceFile) {
         message: "Global declarations require an explicit low-level integration allowlist."
       });
     }
-    if (ts4.isInterfaceDeclaration(statement) && statement.name.text === "Window") {
+    if (ts2.isInterfaceDeclaration(statement) && statement.name.text === "Window") {
       warnings.push({
         rule: "akan.file.window-augmentation",
         scope: "file",
@@ -1228,7 +957,7 @@ function getGlobalMutationWarnings(sourceFile) {
         message: "Window augmentation should be isolated to approved browser integration files."
       });
     }
-    if (ts4.isExpressionStatement(statement) && statement.expression.getText(sourceFile.sourceFile).includes(".prototype.")) {
+    if (ts2.isExpressionStatement(statement) && statement.expression.getText(sourceFile.sourceFile).includes(".prototype.")) {
       warnings.push({
         rule: "akan.file.prototype-mutation",
         scope: "file",
@@ -1246,23 +975,23 @@ function getTopLevelDeclarations(sourceFile) {
 }
 function getTopLevelDeclaration(sourceFile, statement) {
   const line = getLine(sourceFile, statement);
-  if (ts4.isClassDeclaration(statement) && statement.name) {
+  if (ts2.isClassDeclaration(statement) && statement.name) {
     return [{ name: statement.name.text, kind: "class", line, exported: isExported(statement), node: statement }];
   }
-  if (ts4.isFunctionDeclaration(statement) && statement.name) {
+  if (ts2.isFunctionDeclaration(statement) && statement.name) {
     return [{ name: statement.name.text, kind: "function", line, exported: isExported(statement), node: statement }];
   }
-  if (ts4.isInterfaceDeclaration(statement)) {
+  if (ts2.isInterfaceDeclaration(statement)) {
     return [{ name: statement.name.text, kind: "interface", line, exported: isExported(statement), node: statement }];
   }
-  if (ts4.isTypeAliasDeclaration(statement)) {
+  if (ts2.isTypeAliasDeclaration(statement)) {
     return [{ name: statement.name.text, kind: "type", line, exported: isExported(statement), node: statement }];
   }
-  if (ts4.isEnumDeclaration(statement)) {
+  if (ts2.isEnumDeclaration(statement)) {
     return [{ name: statement.name.text, kind: "enum", line, exported: isExported(statement), node: statement }];
   }
-  if (ts4.isVariableStatement(statement)) {
-    return statement.declarationList.declarations.filter((declaration) => ts4.isIdentifier(declaration.name)).map((declaration) => ({
+  if (ts2.isVariableStatement(statement)) {
+    return statement.declarationList.declarations.filter((declaration) => ts2.isIdentifier(declaration.name)).map((declaration) => ({
       name: declaration.name.text,
       kind: "variable",
       line: getLine(sourceFile, declaration),
@@ -1270,7 +999,7 @@ function getTopLevelDeclaration(sourceFile, statement) {
       node: statement
     }));
   }
-  if (ts4.isExportDeclaration(statement)) {
+  if (ts2.isExportDeclaration(statement)) {
     return [{ name: "export declaration", kind: "export", line, exported: true, node: statement }];
   }
   return [];
@@ -1295,9 +1024,9 @@ function isAllowedConstantDeclaration(modelName, declaration) {
     return false;
   if ([`${modelName}Input`, `${modelName}Object`, modelName, `Light${modelName}`, `${modelName}Insight`].includes(declaration.name))
     return true;
-  if (!ts4.isClassDeclaration(declaration.node))
+  if (!ts2.isClassDeclaration(declaration.node))
     return false;
-  const heritageClause = declaration.node.heritageClauses?.find((clause) => clause.token === ts4.SyntaxKind.ExtendsKeyword);
+  const heritageClause = declaration.node.heritageClauses?.find((clause) => clause.token === ts2.SyntaxKind.ExtendsKeyword);
   const expression = heritageClause?.types[0]?.expression;
   return !!expression && expression.getText().startsWith("enumOf(");
 }
@@ -1363,13 +1092,13 @@ function getModuleInfo(file) {
   return { moduleName, fileName, kind: "database" };
 }
 function isExportedConst(declaration) {
-  return declaration.exported && ts4.isVariableStatement(declaration.node) && (declaration.node.declarationList.flags & ts4.NodeFlags.Const) !== 0;
+  return declaration.exported && ts2.isVariableStatement(declaration.node) && (declaration.node.declarationList.flags & ts2.NodeFlags.Const) !== 0;
 }
 function isExported(node) {
-  return !!ts4.getCombinedModifierFlags(node) && !!(ts4.getCombinedModifierFlags(node) & ts4.ModifierFlags.Export);
+  return !!ts2.getCombinedModifierFlags(node) && !!(ts2.getCombinedModifierFlags(node) & ts2.ModifierFlags.Export);
 }
 function isFunctionLikeInitializer(node) {
-  return !!node && (ts4.isArrowFunction(node) || ts4.isFunctionExpression(node));
+  return !!node && (ts2.isArrowFunction(node) || ts2.isFunctionExpression(node));
 }
 function getBodyFingerprint(sourceFile, node) {
   if (!node)
@@ -1391,7 +1120,7 @@ async function isDirectory(absolutePath) {
   }
 }
 function getScriptKind(file) {
-  return file.endsWith(".tsx") ? ts4.ScriptKind.TSX : ts4.ScriptKind.TS;
+  return file.endsWith(".tsx") ? ts2.ScriptKind.TSX : ts2.ScriptKind.TS;
 }
 function getLine(sourceFile, node) {
   return sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1;
@@ -1412,7 +1141,7 @@ function toPascalCase(value) {
   return value.replace(/(^|[-_./])([a-zA-Z0-9])/g, (_, __, char) => char.toUpperCase()).replace(/[-_./]/g, "");
 }
 function toPosix(value) {
-  return value.split(path3.sep).join("/");
+  return value.split(path.sep).join("/");
 }
 function groupBy(items, getKey) {
   const grouped = new Map;

package/templates/appSample/srvkit/AuthGuard.ts

@@ -15,8 +15,8 @@ export default function getContent(scanInfo: AppInfo | LibInfo | null, dict: { a
 export class SignedIn implements Guard {
   static name = "SignedIn";
   // "account" — the verdict reads the caller and nothing about the call, so an MCP catalogue can evaluate it with
-  // no arguments and hide what this caller certainly cannot use. Unmarked means "resource", which is never
-  // evaluated for a listing: a guard like this one would then filter nothing.
+  // no arguments and hide what this caller certainly cannot use. Required: "resource" is never evaluated for a
+  // listing, so a guard like this one marked that way would filter nothing.
   static scope: GuardScope = "account";
 
   canPass(context: SignalContext): boolean {